The Arch Linux project has temporarily disabled the ability for contributors to adopt Arch User Repository (AUR) packages after a surge of malicious takeovers. Attackers have been claiming ownership of abandoned or low-activity packages and replacing their contents with info-stealing malware, a technique known as a supply chain attack. The campaign was announced on the Arch Linux mailing list by contributor Robin Candau, who urged the community to “stay vigilant” and report suspicious adoption events or commits while a more permanent solution is developed.
Security researchers at IFIN report that this campaign closely mirrors a previous wave, including the use of the Tor network for staging the malicious payloads. The attackers appear to target packages that still have users but have gone unmaintained, adopting them through the legitimate AUR contribution process before injecting stealer code. Because AUR packages are community-built and not signed by the Arch Linux project itself, users who install them run whatever code the current maintainer has uploaded. The freeze on new adoptions is intended to break the attack chain while Arch Linux evaluates stronger safeguards.
How to check if you’re affected
Affected products include any AUR packages that changed maintainer in the past few weeks. Arch Linux users should:
- Check recently installed AUR packages with
pacman -Qand cross-reference against the AUR web interface to see if the maintainer changed recently. - Review the
PKGBUILDfile of any suspect package for unexpectedcurl,wget, or base64-encoded payloads before building. - Avoid installing any AUR packages with new adoptions until Arch Linux issues an official all-clear.